@yoda: "This looks like a new virus; OfficeScan is unable to find it. Here
goes the syntoms:
- exploits port 445; massively tries random IPs in the same subnet the
machine is on; this leads to a ARP storm;
- opens a backdoor at some port; responds to connections to that port
with the message "220 StnyFtpd 0wns j0"; this may look like
WORM_KIBUV.B, but its behaviour differs w.r.t. the other syntoms;
- opens an IRC connection to the IP 83.161.120.155 port 31375; I
intercepted these two messages:
(1) "PRIVMSG #Exploit :[lsass_445]: Exploiting "
(2) ":HyperX.DarK.Com 404 nirjwmd #Exploit :No "
and the IRC server identifies itself as "HyperX.DarK.Com (�DarK�
NeTworKs Root Server)";
- one of the infected machines identifies itself to the IRC server as
"nirjwmd (<email_address>)";
Any clues? Any place where it may be useful to report this info to?
Cheers,
Rodrigo
*** Rodrigo Martins de Matos Ventura <email_address>
***  Web page: <url>
***   Teaching Assistant and PhD Student at ISR:
***    Instituto de Sistemas e Robotica, Polo de Lisboa
***     Instituto Superior Tecnico, Lisboa, PORTUGAL
*** PGP fingerprint = 0119 AD13 9EEE 264A 3F10  31D3 89B3 C6C4 60C6 4585"
    @richardsw: "news:<email_address>
<quote>
Using the lsass exploit, scanning the network, and talking to an IRC server.
I immediately think an Agobot variant.  You can report to it to any number
of antivirus vendors, but their reply will probably be a generic virus
identification that won't help you clean it.  If this thing is already
uploading info to an irc server, and it's on a domain, you're going to want
to change all your passwords after you get it cleaned off.
Richard S. Westmoreland
<url>"
    @yoda: "<quote>
    David> * * * Please report your results ! * * *
McAfee AVERT WebImmune detected a virus in the winxp2.exe file:
w32/sdbot.worm.gen.h.
Cheers,
Rodrigo
*** Rodrigo Martins de Matos Ventura <email_address>
***  Web page: <url>
***   Teaching Assistant and PhD Student at ISR:
***    Instituto de Sistemas e Robotica, Polo de Lisboa
***     Instituto Superior Tecnico, Lisboa, PORTUGAL
*** PGP fingerprint = 0119 AD13 9EEE 264A 3F10  31D3 89B3 C6C4 60C6 4585"
{'source': 'USENET', 'other_information': '{"reply_count": 2, "forum_name": "alt.comp.anti-virus.20140701.mbox"}', 'file': 'data/output/usenet-alt.comp.parquet'}